CVE-2021-24565CWE-352CWE-79

Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS

published August 23, 2021

CVSS
—
EPSS
1%
Percentile
53.4
In the wild
Unconfirmed
What it is

The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00719 · 53.4th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-08-23T11:10Z
EPSS history
Timeline
  • 23 AUG 11:10Z
    Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS
    cvelistv5